this bug happened when i'm testting the "step 2" on "tutorial-i386.exe", it's only stop twice after run this command.
here is step reproduce:
set break point on "tutorial-i386.exe"+2622B and then click "hitme", ce will break at preview break point, press shift+f8 then EIP will be "tutorial-i386.exe"+AB19E, shift-f8 eip will be "tutorial-i386.exe"+146123, but at this time the title on memory view is "Running", ofcource, i'm cann't press shift-f8 any more. :D

No, i do not think setting breakpoint at "return address" when you use "stack walk" method is a good idea, in many cases, it give us wrong address, even now, there is no way to make sure eip will jump-back to an address on stack pointer. The best way, i think, use "Step over until ret" intead using set breakpoint method.

about tutorial step 2: there is at least 10 address you can jump back, but in your CE "Run util ret" only have two :D